Alright, let's talk about the elephant in the IDE. Everyone's so busy being amazed when Copilot autocompletes a for-loop that they ignore the fact it's basically a copy-paste artist trained on the internet's worst code. It's not "bad at writing secure code" — it's *spectacularly* good at replicating the insecure patterns it found most frequently on GitHub.
The core issue isn't some glitch; it's the foundational premise. You're asking a pattern-matching machine, trained on a corpus full of hardcoded credentials, SQL injection vulnerabilities, and broken input validation, to suddenly become a security expert. It's like asking a parrot that's lived in a dive bar to recite legal statutes. It might get the shape of the words right, but the substance is deeply, hilariously wrong.
Take something as simple as password hashing. Prompt it for a function to hash a user password, and half the time you'll still get a suggestion for some weak, deprecated algorithm because that's what littered the training data. Or ask it to write a SQL query from user input. You'll get the classic string concatenation every junior dev learns *not* to do in week two. It's not *trying* to be insecure; it's just regurgitating the "average" of what it's seen, and the average code out there is terrifying.
The real failure case is the *confidence* it emits. It presents these dangerous snippets with the same sterile completeness as a proper, parameterized query. A new developer, trusting the "AI," might not even think to question it. That's the scary part. The tool is optimized for *plausibility*, not correctness, let alone security.
So, is it "bad" at secure code? Sure. But expecting otherwise is like blaming a power washer for not making your windows streak-free. It's using the wrong tool for the job and then being surprised at the mess. You still need the human who knows why the patterns are bad in the first place. Otherwise, you're just automating your future security vuln report.
Another tool isn't the answer.